Give a specific user role the ability to give a user a role but not the 'administrator' role

Question

I have a set up using drupal 7 where, as a super administrator, I can add a user with a role of 'manager' (who can also add users to his shop) but I want to also give 'manager' the ability to specify if the user he wants to add will have either of the two simple roles (one to create/add data and one to view reports on sales only) say, 'sales-agent', 'sales-report'. Currently, in my setup, the manager can specify all roles including the 'administrator' role which I should have access only as a developer/super admin.

I have been looking around for modules to fit this but my time is running out.

Thanks for all your help. Drupal is great!

Answer 1

There is a perfect module for you - Role Delegation - and there is a stable 7.x release as well. Here is an excerpt about it from the module's project page:

... allows site administrators to grant some roles the authority to assign selected roles to users, without them needing the administer permissions permission.

For each role, Role Delegation provides a new assign ROLE role permission to allow the assignment of that role.

Answer 2

Use the Flag module to create 2 (not global) flags, with these details:

• These flags will be used to flag users (not nodes or something).

• Say you label those flags Create/add data and View reports.

• Only users who have role manager are allowed to use these flags (something you can specify when configuring these flags).

Create a 1st rule (using the Rules module) like so:

• Rules Event: User gets flagged by the View reports flag.

• Rules Action: Grant Access to your role to View reports.

Create a 2nd rule that is similar to the 1st rule, but now for the Create/add data (flag and role).

Possible improvements

You could take this even a step further, also using Rules: Create a 3rd (and 4th) rule with Rules Event "User is unflagged", and trigger a Rules Action "Remove access to the role corresponding to the flag".

If you want, you can even consolidate these 4 rules in a single rule, using the Conditional Rules module.

Avoid modulitis

With the above approach, you reduce the risk your site starts to suffer modulitis (= way too much contributed modules that only do 1 specific thing). Because chances are that you already use Rules in your site, maybe also Flag already. And if you're not using these modules yet, you'll find dozens of other use-cases for those 2 modules ... and possibly get rid of even more contributed modules that only do 1 thing (what else can you use the Role delegation module for?).